---

FEMA IT Specialist Charged in ID Theft, Tax Refund Fraud Conspiracy

An information technology specialist at the Federal Emergency Management Agency (FEMA) was arrested this week on suspicion of hacking into the human resource databases of University of Pittsburgh Medical Center (UPMC) in 2014, stealing personal data on more than 65,000 UPMC employees, and selling the data on the dark web.

---

Healthcare CISOs Share COVID-19 Response Stories

Cybersecurity leaders discussed the threats and challenges that arose during the pandemic, and how they responded, during a virtual roundtable.

---

Mozilla to launch VPN product 'in the next few weeks'

Mozilla VPN to exit beta this summer. Future plans include launching a Mac client. Currently only available on Windows, Android, iOS, and Firefox extension.

---

Cisco Patches Flaw in Webex Videoconferencing App

Vulnerability would have allowed an attacker to gain access to sensitive information on a system, Trustwave's SpiderLab says.

---

Google Yanks 106 ‘Malicious’ Chrome Extensions

Trojan Chrome browser extensions spied on users and maintained a foothold on the networks of financial services, oil and gas, media and entertainment, healthcare and pharmaceuticals and government organizations.

---

Facebook’s FTC-Mandated Privacy Committee Now in Effect

Facebook will report its privacy practices to both the committee, the FTC, and to a third-party assessor.

---

Have Your Say: Dark Reading Video News Desk Seeks Reader Contributions

We've got questions for you on black infosec, burnout, vulnerabilities, COVID-19, and much more. Send us your video responses and we'll play them in our News Desk broadcast during Black Hat Virtual.

---

Facebook sues websites that sold Instagram likes and scraped Facebook user data

Facebook files lawsuits against MGP25 Cyberint Services in Spain and against Massroot8 in the US.

---

IcedID Banker is Back, Adding Steganography, COVID-19 Theme

The malware has boosted its anti-detection capabilities in a new email campaign.

---

The Bigger the News, the Bigger the Cyber Threats

Criminals use disasters, wars, and now pandemics as air cover to focus collective anxiety and fear into highly targeted, malicious messaging.

---

60% of Businesses Plan to Spend More on Cyber Insurance

New data reveals 65% of SMEs plan to invest more in cyber insurance, compared with 58% of large enterprises.

---

Russia unbans Telegram

Russia's media watchdog Roskomnadzor said Telegram has agreed to help Russian law enforcement fight against extremist and terrorist content shared on its platform.

---

O365 Phishing Campaign Leveraged Legit Domains

A sophisticated scheme used legitimate redirection tools to convince victims to give up Office 365 credentials.

---

Cisco Webex, Router Bugs Allow Code Execution

High-severity flaws plague Cisco's Webex collaboration platform, as well as its RV routers for small businesses.

---

Most Contact-Tracing Apps Fail Basic Security

A survey of 17 Android applications for informing citizens if they had potential contact with a COVD-19-infected individual finds few have adopted code-hardening techniques.

---

Google removes 106 Chrome extensions for collecting sensitive user data

Security firm identifies 111 malicious Chrome extensions collecting user keystrokes, clipboard content, cookies, more.

---

CISO Dialogue: How to Optimize Your Security Budget

CISOs are never going to have all the finances they want. Hard choices must be made. The CISO of Amazon Prime Video discusses his approaches to a slimmed-down budget.

---

BofA Phish Gets Around DMARC, Other Email Protections

The June campaign was targeted and aimed at stealing online banking credentials.

---

Five Password Tips for Securing the New WFH Normal

Darren James, product specialist with Specops Software, warned that password resets, for example, are a particularly vexing issue for sysadmins, as they can often lockout end-users from their accounts.

---

Phishing Campaign Targeting Office 365, Exploits Brand Names

Attackers use trusted entities to trick victims into giving up their corporate log-in details as well as to bypass security protections.